[tptacek]

As you can see, it's not at all hard.

[mzs]

Yes if it's that it's not even particularly computationally expensive. I hope that's not the crux of the flaw.

edit: seems to be this bug letting attacker specify params https://twitter.com/thracky/status/1217175743316348929